Read the docs
TI-2026-17596 Aliases CVE-2026-21896GHSA-4j78-4xrm-cr2f

Kirby is missing permission checks in the content changes API

Priority LOW 26CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Fix Fixed kirby (getkirby): 5.2.2getkirby/cms (Packagist): 5.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getkirbykirby5.0.0 to before 5.2.25.2.2Patch availableCNA
—getkirby/cms (Packagist)5.0.0 to before 5.2.25.2.2Patch availableGHSA-4j78-4xrm-cr2f
  • kirby Vendorgetkirby Affected 5.0.0 to before 5.2.2 Fixed in 5.2.2 Patch available CNA
  • getkirby/cms (Packagist) Vendor— Affected 5.0.0 to before 5.2.2 Fixed in 5.2.2 Patch available GHSA-4j78-4xrm-cr2f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*5.0.0 to before 5.2.2Vulnerablegetkirby
  • cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.2.2 Vulnerable ·getkirby

Remediation

  • Fix · CNA kirby (getkirby) Fixed in 5.2.2
  • Fix · GHSA-4j78-4xrm-cr2f getkirby/cms (Packagist) Fixed in 5.2.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21896
  2. 2026-10-03 Alias added: GHSA-4j78-4xrm-cr2f

References

Patch 2

Advisory 1

Other 2

  • TI-2024-17440 An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0… CVSS 3.1HIGH 8.8
  • TI-2024-17439 An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS… CVSS 3.1HIGH 7.1
  • TI-2026-23396 Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a… CVSS 3.1MEDIUM 6.5
  • TI-2024-17441 A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of… CVSS 3.1MEDIUM 6.1
  • TI-2018-10413 An issue was discovered in Kirby 2.5.12. CVSS 3.1MEDIUM 5.4
  • TI-2024-17438 Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. CVSS 3.1MEDIUM 4.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences